Certified control for self-driving cars

2. The method of claim 1, in which directing further comprises passing, by the interlock controller, the proposed vehicle control action to the low-level controller if the safety certification evidence from the certificate is verified by the interlock controller.

4. The method of claim 3, in which the intervention vehicle control action comprises braking, throttling, and/or steering.

5. The method of claim 3, in which directing comprising translating, by the low-level controller, the certified vehicle control action into actuations of brakes, throttle, and/or steering.

6. The method of claim 3, in which the interlock controller uses the sensor data to confirm safety of the intervention vehicle control action.

7. The method of claim 1, in which the safety certification evidence of the certificate includes time stamped and signed evidence to verify the proposed vehicle control action is safe.

8. The method of claim 1, in which the certified vehicle control action comprises the proposed vehicle control action.

9. The method of claim 1, in which the certified vehicle control action comprises an intervention vehicle control action selected by the interlock controller.

12. The non-transitory computer-readable medium of claim 11, in which the program code to direct comprises program code to translate, by the low-level controller, the certified vehicle control action into actuations of brakes, throttle, and/or steering.

13. The non-transitory computer-readable medium of claim 10, further comprising program code to pass, by the interlock controller, the proposed vehicle control action to the low-level controller if the safety certification evidence from the certificate is verified by the interlock controller.

14. The non-transitory computer-readable medium of claim 10, in which the safety certification evidence of the certificate includes time stamped and signed evidence to verify the proposed vehicle control action is safe.

15. The non-transitory computer-readable medium of claim 10, in which the certified vehicle control action comprises an intervention vehicle control action selected by the interlock controller.

17. The system of claim 16, in which the interlock controller is further configured to the proposed vehicle control action to the low-level controller if the safety certification evidence from the certificate is verified by the interlock controller.

18. The system of claim 16, in which the interlock controller is further configured to replace the proposed vehicle control action with an intervention vehicle control action if the safety certification evidence from the certificate is not verified.

19. The system of claim 18, in which the low-level controller is further configured to direct the self-driving ego vehicle to perform the intervention vehicle control action.

20. The system of claim 16, in which the low-level controller is further configured to translate the certified vehicle control action into actuations of brakes, throttle, and/or steering of the self-driving ego vehicle.